https://community.splunk.com/t5/Getting-Data-In/How-to-break-event-consisting-json-data-properly/m-p/436035#M76100 <P>Try using this</P> <PRE><CODE>[source::/path/to/log/dir/*] SHOULD_LINEMERGE = false NO_BINARY_CHECK = 1 LINE_BREAKER = ([\r\n]+)(?=\d{4}-\d{2}-\d{2}\s\[) TRUNCATE = 0 </CODE></PRE> Thu, 12 Jul 2018 15:25:39 GMT somesoni2 2018-07-12T15:25:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-break-event-consisting-json-data-properly/m-p/436034#M76099 <P>Hi everyone, I have a log file of the below pattern:<BR /> 2018-05-24 [POST] 8.8.8.8 GET /api {<BR /> json: data<BR /> }<BR /> And it is not breaking properly.<BR /> the event is cut in the middle of the json data.<BR /> my props.conf is as follows:<BR /> [source::/path/to/log/dir/*]<BR /> SHOULD_LINEMERGE = false<BR /> NO_BINARY_CHECK = 1<BR /> LINE_BREAKER = (?:}) ([\r\n]+)<BR /> TRUNCATE = 0</P> <P>Please help me understand this better...</P> Tue, 29 Sep 2020 20:25:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-break-event-consisting-json-data-properly/m-p/436034#M76099 stamstam 2020-09-29T20:25:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-break-event-consisting-json-data-properly/m-p/436035#M76100 <P>Try using this</P> <PRE><CODE>[source::/path/to/log/dir/*] SHOULD_LINEMERGE = false NO_BINARY_CHECK = 1 LINE_BREAKER = ([\r\n]+)(?=\d{4}-\d{2}-\d{2}\s\[) TRUNCATE = 0 </CODE></PRE> Thu, 12 Jul 2018 15:25:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-break-event-consisting-json-data-properly/m-p/436035#M76100 somesoni2 2018-07-12T15:25:39Z